Engineering Standard

Transcription

1 Engineering Standard Rolling Stock CRN RS 013 DRIVER SAFETY SYSTEM REQUIREMENTS FOR ROLLING STOCK Version: 2.0 Issued: October 2016 Owner: Approved by: Authorised by: Principal Engineer Rolling Stock and Plant Bryan Turnbull James Zeaiter Disclaimer. This document was prepared for use on the CRN Network only. John Holland Rail Pty Ltd makes no warranties, express or implied, that compliance with the contents of this document shall be sufficient to ensure safe systems or work or operation. It is the document user s sole responsibility to ensure that the copy of the document it is viewing is the current version of the document as in use by JHR. JHR accepts no liability whatsoever in relation to the use of this document by any party, and JHR excludes any liability which arises in any manner by the use of this document. Copyright. The information in this document is protected by Copyright and no part of this document may be reproduced, altered, stored or transmitted by any person without the prior consent of JHG. UNCONTROLLED WHEN PRINTED Page 1 of 19

2 Document control Revision Date of Approval Summary of change /9/11 For publication 2.0 5/10/16 Reviewed for currency and as shown below Summary of changes from previous version Section Vigilance timing tables reformatted Summary of change Note added covering the need for a driver safety system for a single person operation within yards and sidings. JHR UNCONTROLLED WHEN PRINTED Page 2 of 19

3 Contents 1 Scope Definitions Authorised Person Circumvention Coasting Deadman device Downgraded operating conditions Driver/operator Driver safety system Existing vehicles Emergency cock Isolation Locomotive Motive power unit Operator enable system Possession CRN (Country Regional Network) Second person Substantially modified vehicle Task linked vigilance system Train stop/trip gear system Vigilance control system Design parameters Circumvention Isolation Failsafe Emergency cock Trip gear valve Operator enable system Vigilance system Minimum requirements for rolling stock Multiple unit passenger trains (including XPT) Locomotive hauled freight and passenger trains Infrastructure maintenance vehicles (with a driver s compartment/position) Train stop/trip gear system Function Major componentry Operation Operator enable system Function Operation Vigilance system Function Operation Vigilance control - driver interface On board data logging Alternate driver safety systems Appendix 1 CRN Rolling Stock Glossary JHR UNCONTROLLED WHEN PRINTED Page 3 of 19

4 1 Scope This standard covers rail vehicle safety equipment and its performance for the safe movement of all rail bound and road/rail vehicles operating on the CRN. The performance requirements are designed to provide an acceptable level of safety and integrity to rolling stock, infrastructure and all personnel interfacing with the rolling stock. 2 Definitions 2.1 Authorised Person An Authorised Person, in the context of this document, is a person accompanying the driver/operator in the driver/operator s cab of a train/vehicle, who has been suitably briefed by the operator/driver, on the method of taking control and stopping the train/vehicle, in the event of the operator/driver becoming incapacitated. 2.2 Circumvention Circumvention, in the context of this document, is the improper or inadvertent removal of, or bypassing a safety system, other than by an authorised procedure. 2.3 Coasting The movement of a train/vehicle with the reverser handle in the neutral or off position in such a manner as to circumvent one or more safety systems. 2.4 Deadman device See operator enable system. 2.5 Downgraded operating conditions Operating conditions imposed in order to reduce risk, such as an imposed speed restriction. 2.6 Driver/operator A person suitably qualified to operate the controls of a powered vehicle or train on the CRN. 2.7 Driver safety system The combination of safety devices and associated logics such as an operator enable system, vigilance device and trip valve mechanism, fitted to the driven portion of a train or vehicle. 2.8 Existing vehicles Vehicles currently accepted for operation on the CRN and the NSW rail system as at the date of issue of this version of the standard. 2.9 Emergency cock A hand operated valve used for directly venting the brake pipe to atmosphere, located within a crew work area or in an appropriate location on the vehicle for access by authorised personnel. JHR UNCONTROLLED WHEN PRINTED Page 4 of 19

5 2.10 Isolation Isolation is the deactivation of the safety system by an authorised procedure Locomotive A Locomotive, in the context of this document, is a rail bound vehicle with its own power source that is exclusively employed for the task of controlling and moving other rail bound vehicles Motive power unit A motive power unit, in the context of this document, is a vehicle with its own power source that has a prime function other than that of a locomotive, but can be utilised for controlling and moving rail bound vehicles Operator enable system A device which reacts by directly venting the brake pipe to atmosphere if a continuous control input required of the driver/operator is interrupted or not detected Possession The closure of one or more rail tracks to allow work to be carried out in the danger zone, using a Local Possession Authority (LPA) or a Track Occupancy Authority (TOA) CRN (Country Regional Network) The Country Regional Network covers regional branch lines in the North, West and Southern areas of NSW. Refer to the CRN Train Operating Conditions (TOC) Manual for the CRN corridors Second person A suitably qualified person, who may be required to accompany the driver/operator in the control cab of a locomotive, train or vehicle Substantially modified vehicle A vehicle modified to permit it to be used for a different purpose. A vehicle that undergoes a major refurbishment with updated equipment, which may include the installation of specific equipment to meet all or in part, the requirements of this standard Task linked vigilance system A vigilance system that accepts specified task functions as input, to satisfy a crew acknowledgment requirement within the vigilance control system Train stop/trip gear system A system involving a trip valve on the train/vehicle and a trip arm located track side which when engaged, directly vents the brake pipe, on the train/vehicle, to atmosphere. The train stop is employed at signals in conjunction with a red aspect and also in areas where train speed is required to be externally controlled Vigilance control system A system that will react by bringing a vehicle/train to a stand if an acknowledgment input from a driver/operator is not received within a specified time increment. On conventional vehicles with an automatic brake this is achieved by directly venting the brake pipe to atmosphere. JHR UNCONTROLLED WHEN PRINTED Page 5 of 19

6 3 Design parameters 3.1 Circumvention The driver safety system shall be designed to minimise the possibility or opportunity for circumvention of any or all of the safety system elements by improper or inadvertent use of either isolation devices or driving controls. This may be achieved by the fitment of security seals to isolation devices. 3.2 Isolation The driver safety system shall be designed to permit isolation of each sub-system in the event of failure of any vital driver safety system component, thus requiring an authorised procedure to allow the train/vehicle to proceed. 3.3 Failsafe The driver safety system shall be designed such that the failure of a vital component/system or the incorrect operation of a vital component/system, results in the train/vehicle being rendered to a safe condition. To be failsafe the system and components of the driver safety system shall be designed such that: the system must be operative for the vehicle to move on track under the control of a driver/operator and; the brake pipe is directly vented to atmosphere should there be any vital component or circuit failure or the required sequence of events or control signals do not occur within a specified timeframe. 3.4 Emergency cock On vehicles with an automatic air brake system, opening of the emergency cock shall ensure that the brake pipe is directly vented to atmosphere, traction power is cut via the control governor and an automatic brake application is initiated on all vehicles within a train. On vehicles without an automatic brake system, opening of the emergency cock shall vent or release the pressure holding the spring parking brake cylinder in the off position, thus resulting in the application of the spring parking brake. On some vehicles without an automatic brake system, an emergency brake button may be used in place of an emergency cock. In this case, the activation of the emergency brake button shall cut traction power and apply the emergency brake on all vehicles within the train consist. 3.5 Trip gear valve The trip gear valve shall be designed such that when mounted on the leading left hand axlebox of the vehicle or train, the trip arm of the trip gear valve strikes the raised trackside train stop, the brake pipe is directly vented to atmosphere, traction power is cut via the control governor and an automatic (emergency) brake application is initiated on all vehicles within a train. NOTE: There is no requirement for a trip gear valve for operation on the CRN, however multiple unit rolling stock passing to and from the adjacent Sydney Trains Network must be fitted with such equipment. For CRN operation there is a requirement for the trip valve arm to be retracted. JHR UNCONTROLLED WHEN PRINTED Page 6 of 19

7 3.6 Operator enable system The Operator enable system, formerly known as a Deadman Device, is to be designed such that when a controlled input signal from the driver is interrupted, the operator enable system shall activate the brake pipe dump valve ensuring that the brake pipe is directly vented to atmosphere, traction power is cut via the control governor and an automatic brake application is initiated on all vehicles within a train. On vehicles without an automatic brake system, the pressure that is holding the spring parking brake cylinder off shall be vented or released upon an automatic (emergency) brake application, resulting in the application of the spring parking brake. These vehicles shall also have the traction power cut out. 3.7 Vigilance system The vigilance system shall be designed such that when the alert/warning/alarm system is not acknowledged by the driver/operator within a set time limit the system shall activate the brake pipe dump valve ensuring that the brake pipe is directly vented to atmosphere, traction power is cut via the control governor and an automatic brake application is initiated on all vehicles within a train. On vehicles without an automatic brake system, the dump valve shall vent or release the pressure holding the spring parking brake cylinder in the off position, thus resulting in the application of the spring parking brake. 4 Minimum requirements for rolling stock The minimum requirements for the application of a driver safety system to vehicles operating on the CRN shall be as follows: 4.1 Multiple unit (driver only) passenger trains (including locomotives designed to operate exclusively for passenger operations as power cars) For interoperability across rail networks, each driven vehicle shall include a driver safety system incorporating the following: An operator enable system A trip gear valve and/or a level 2 compliant ATP (automatic train protection) system A vigilance control system (task linked and non-speed dependant) An emergency cock An on-board control system that shall not allow the train/vehicle to power up, move or continue in motion with the driver safety system isolated, except under degraded and specifically defined operating conditions. 4.2 Locomotive hauled freight and passenger trains For interoperability across rail networks, each locomotive driver s compartment shall include a driver safety system incorporating the following: A vigilance system A second person An emergency cock JHR UNCONTROLLED WHEN PRINTED Page 7 of 19

8 An on-board control system that shall not allow the train to power up, move or continue in motion with the driver safety system isolated, except under degraded and specifically defined operating conditions. NOTE: Locomotives operating exclusively in shunting yards do not require driver safety systems. However, if such locomotives are required to be moved on the main line they need to be hauled dead attached or operated within a locomotive consist but not as the lead locomotive. OR For Driver Only Operation, A vigilance system An operator enable system An emergency cock An on-board control system that shall not allow the train to power up, move or continue in motion with the driver safety system isolated, except under degraded and specifically defined operating conditions. A pressure maintaining brake valve A working onboard communications equipment which provides direct communications with the train control centre Door locks to prevent illegal entry of cab while locomotive is unattended A dump valve clamp (DVC) present in the lead locomotive NOTE 1: Driver only operation of locomotive hauled freight and passenger trains is not permitted on the CRN unless specifically authorised by the Network Manager. NOTE 2: Locomotives used for shunting purposes on the CRN and operated by a single person, with a second person on the ground acting as a shunter, must be fitted with an Operator Enable or a Vigilance System. 4.3 Infrastructure maintenance vehicles (with a driver/operator s compartment/position) On-track (rail bound) infrastructure maintenance vehicles This clause covers on-track (rail bound) infrastructure maintenance vehicles operating in travel mode, alone or as a motive power unit hauling/controlling other infrastructure maintenance vehicles between and within track possessions, and with a potential for having a kinetic energy (E), exceeding 600 kilojoules (600 kilo-newton metres), based on the following formula. E = MV 2 Where E = kinetic energy (kilojoules) M = maximum vehicle mass (including hauled vehicles) (tonnes) V = maximum vehicle speed (km/h) When the value of E for a vehicle is greater than 600 kilojoules, the driving compartment/position controlling the operation of the vehicle/train shall include a driver safety system incorporating the following: A vigilance system JHR UNCONTROLLED WHEN PRINTED Page 8 of 19

9 OR An authorised second person to stop the vehicle/train in the event of an emergency. An emergency cock or alternate suitable device for stopping the vehicle in an emergency (emergency brake application and removal (cutting) of traction power). An on-board control system that shall not allow the vehicle to power up, move or continue in motion with the driver safety system isolated, except under degraded and specifically defined operating conditions. An ONRSR approved process to enable suppression of the vigilance system whilst the vehicle is in work mode within a possession. For driver only operation, A vigilance system An operator enable system An emergency cock or alternate suitable device for stopping the vehicle in an emergency (emergency brake application and removal (cutting) of traction power) An on-board control system that shall not allow the vehicle to power up, move or continue in motion with the driver safety system isolated, except under degraded and specifically defined operating conditions An ONRSR approved process to enable suppression of the vigilance system whilst the vehicle is in work mode within a possession NOTE: Where it is not possible to incorporate a suitable driver safety system within the vehicle, the vehicle maximum allowable speed must be reduced to bring the value of E below 600 kilojoules Road/rail infrastructure maintenance vehicles This clause covers road/rail infrastructure maintenance vehicles, (except those covered by clause 4.3.3) operating in travel mode, alone or as a motive power unit hauling/controlling other infrastructure maintenance vehicles between and within track possessions, and with a potential for having a kinetic energy (E), exceeding 600 kilojoules (kilo-newton metres), based on the following formula. E = MV 2 Where E = kinetic energy (kilojoules) M = maximum vehicle mass (including hauled vehicles) (tonnes) V = maximum vehicle speed (km/h) When the value of E for a vehicle is greater than 600 kilojoules, the driving compartment/position controlling the operation of the vehicle/train shall include a driver safety system incorporating the following: A vigilance system An authorised second person to stop the vehicle/train in the event of an emergency OR An emergency cock or alternate suitable device for stopping the vehicle in an emergency (emergency brake application and removal (cutting) of traction power) An ONRSR approved process to enable suppression of the vigilance system whilst the vehicle is in work mode within a possession. JHR UNCONTROLLED WHEN PRINTED Page 9 of 19

10 For driver only operation, A vigilance system An operator enable system An emergency cock or alternate suitable device for stopping the vehicle in an emergency (emergency brake application and removal (cutting) of traction power) An on-board control system that shall not allow the vehicle to power up, move or continue in motion with the driver safety system isolated, except under degraded and specifically defined operating conditions An ONRSR approved process to enable suppression of the vigilance system whilst the vehicle is in work within a possession NOTE: Where it is not possible to incorporate a suitable driver safety system within the vehicle, the vehicle maximum allowable speed must be reduced to bring the value of E below 600 kilojoules Road/rail prime mover vehicles authorised to operate as a locomotive ONLY, within a track possession This clause covers road/rail prime mover vehicles operating in travel mode, alone or as a locomotive hauling/controlling rail bound rolling stock, exclusively within a track possession. The driving compartment/position controlling the operation of the vehicle/train shall include a driver safety system incorporating the following: OR A driver suitably qualified to operate the vehicle both on road and as a locomotive on rail. A brake controller compatible with the brake system on the vehicles to be hauled/ controlled. A vigilance system A second person An emergency cock or alternate suitable device for stopping the vehicle in an emergency. An on-board control system that shall not allow the vehicle to power up, move or continue in motion with the driver safety system isolated, except under downgraded and specifically defined operating conditions. For driver only operation, A driver suitably qualified to operate the vehicle both on road and as a locomotive on rail. A brake controller compatible with the brake system on the vehicles to be hauled/ controlled. A vigilance system An operator enable system An emergency cock or alternative suitable device for stopping the vehicle or train in an emergency (emergency brake application and removal (cutting) of traction power) An on-board control system that shall not allow the vehicle to power up, move or continue in motion with the driver safety system isolated, except under degraded and specifically defined operating conditions. A pressure maintaining brake valve A working on-board communications equipment which provides direct communications with the train control centre Door locks to prevent illegal entry of cab while vehicle is unattended JHR UNCONTROLLED WHEN PRINTED Page 10 of 19

11 A dump valve clamp (DVC) present in the lead vehicle NOTE 1: Such vehicles shall be fitted with a suitable air compressor and main reservoir system to meet the duty requirements for a main reservoir and train brake air supply. NOTE 2: Driver only operation is not permitted on the CRN unless specifically authorised by the Network Manager. 5 Train stop/trip gear system 5.1 Function The function of the train stop/trip gear system is to catch and stop a train/vehicle, fitted with trip gear, in the event that it fails to stop for a red stop signal aspect. When the train stop arm engages the trip gear lever the associated valve directly vents the train/vehicle brake pipe to atmosphere initiating a cut in traction power and an automatic brake application on all vehicles within the train. The train stop is employed at signals in conjunction with a red aspect and also in areas where train speed is required to be externally controlled. 5.2 Major componentry The major components of the train stop/trip gear system are: A track side train stop/arm A bogie axlebox mounted trip valve/lever A control governor pressure switch or switches A safety apparatus or trip valve isolating cock (SAI cock) 5.3 Operation Interfacing The vehicle mounted trip gear system shall interface with the existing signal train stop and train braking systems Track side equipment The train stop is an existing piece of track side equipment used on the TfNSW Metropolitan Network and positioned adjacent to signals and also positioned as a group of timed train stops in areas requiring speed control. The Train Stop arm is raised when the signal is displaying a red stop aspect or in the area requiring speed control. The track side train stop has set up limits as shown in figure 1 below. JHR UNCONTROLLED WHEN PRINTED Page 11 of 19

12 Figure 1 Trackside train stop mounting dimensions [Reference: RailCorp Signalling Standard SPG-0706]) Train/vehicle onboard equipment The trip gear valve/trip lever system is mounted on the left hand leading axlebox beneath each drivers/operators compartment. The trip lever shall be designed to engage the raised track side trip arm. The trip gear shall be of lightweight construction. A robust design is an important factor in reducing the dynamic loading on the mechanism and its attachment to the bogie axle box. The trip lever shall be spring loaded to allow passing obstructions such as ballast and other signal trip arms in the reverse travel direction. A manual latch shall be provided on the trip valve, to retain the trip lever in the latched up position on the all non-leading vehicles. The design shall be such that, if the operating trip lever is manually latched up (out of service) the trip valve is held open and thus exhausts the brake pipe to atmosphere. Systems that provide automatic raising of the trip gear lever for operation outside the limits of the RailCorp Network shall be designed to maintain the trip valve in the closed position. When the trip valve is activated, the brake pipe pressure drops to a predetermined level, (eg 250 kpa) the pressure switch (control governor or equivalent) shall isolate traction power to the train/vehicle, which, together with an automatic brake application, will bring the train/vehicle to a stand. The trip valve shall be designed to not reset unless the driver makes a deliberate action to reset the trip gear. This may be accomplished by reducing brake pipe pressure below a predetermined level (eg 70 kpa), such that brake pipe will not fall below this level with the brake pipe being charged and with the minimum allowable number of compressors running. Systems that provide automatic or remote raising of the trip gear lever shall provide detection of the raise/lower status, such that traction power is disabled if the trip lever is not lowered, when operating on the RailCorp Network. The trip lever shall be capable of striking a raised train stop arm whilst travelling in the reverse direction at a minimum speed of 25 km/h without trip valve activation, or it shall be latched up on JHR UNCONTROLLED WHEN PRINTED Page 12 of 19

13 terminal cars when trailing in the direction of travel. When the train/vehicle is propelling or reversing, the trip arm must be in the lowered position on the leading car in the direction of travel. The trip lever shall be capable of striking a raised train stop arm whilst travelling in the forward direction at the train/vehicle maximum design speed without causing trip valve malfunction and/or damage to the trip gear or train stop mechanism. 6 Operator enable system 6.1 Function. The function of the operator enable system is to detect the presence of the driver or operator at the controls of the train/vehicle. If a required continuous control input by the driver/operator is interrupted or not detected whilst the train/vehicle is in operating mode, then the system shall react by venting the train/vehicle brake pipe to atmosphere. The venting of the train/vehicle brake pipe shall be accomplished by the system opening the emergency application valve, resulting in a full brake application on the train/vehicle and traction power isolation. Isolation of traction power is effected through a pressure switch when the brake pipe pressure drops to a predetermined level, (eg 250 kpa), which together with the brake application will bring the train to a stand. The operator enable system must interface and be fully compatible with the train/vehicle traction control and braking system Driver incapacitation Loss of circuit continuity within the operator enable system could mean driver incapacitation and possible loss of control of the train/vehicle. The interface between the driver/operator and the operator enable system shall be designed such that, it is necessary for the driver/operator to remain at his/her work station, either sitting or standing and maintain the detection circuit continuity, whilst the train/vehicle is in motion with the brakes released Circumvention The operator enable system shall be designed, as far as practicable, to prevent intentional or unintentional circumvention of its operation whilst the train/vehicle is in motion with the brakes released. 6.2 Operation Controls The driver/operator shall be required to maintain either a spring loaded foot pedal, controller handle or other operator enable system control, continuously in a predetermined position or range, such that the detection circuit continuity is maintained. A venting of the train/vehicle brake pipe shall be initiated if all of the operator enable system controls are released and the detection circuit is opened, whilst the train/vehicle is in motion with the brakes released. Resetting the operator enable system shall be readily achieved by moving any of the operator enable system controls back to their predetermined position or range. A means shall be provided to suppress the operator enable system without driver/operator input, whilst the train/vehicle is stopped at stations or signals. JHR UNCONTROLLED WHEN PRINTED Page 13 of 19

14 6.2.2 Failsafe In addition to the failsafe requirements specified in clause 3.3, the equipment providing the operator enable system function shall provide a failsafe function whilst ever the brakes on the train/vehicle are released and the controller key/reverser handle is in the operating position. This requirement shall apply unless the operator enable system is isolated in accordance with an authorised procedure to allow the train/vehicle to proceed. The operator enable system shall be designed to vent the train/vehicle brake pipe to atmosphere if the system becomes inoperative due to technical failure or due to inappropriate actions by the driver/operator whilst the train is moving with the brakes released. 7 Vigilance system The function of the vigilance system shall be designed to monitor the attentiveness and responsiveness of the driver/operator and take appropriate action to bring the train/vehicle to a safe state should the driver/operator not respond as required. On conventional rolling stock this is achieved by venting the train/vehicle brake pipe to atmosphere in the event that the driver/operator fails to acknowledge the necessary control indications within a specified time interval. 7.1 Function. The vigilance system is a timed cycle of events consisting of first, a visual warning, followed by an auditory signal which, if neither is acknowledged, results in a brake penalty being initiated by venting the train/vehicle brake pipe. Some vigilance systems randomly select the time interval and thus the driver/operator can only acknowledge the vigilance warning after the visual signal. Other systems use task linking to reset the vigilance cycle before the visual warning occurs. The latter system is preferred because it reduces the driver/operator workload and in the main, receives more frequent confirmations of driver/operator awareness. Some trains are fitted with a speed dependent vigilance control system. In this case as the speed increases through speed bands, the vigilance cycle times are decreased. 7.2 Operation Vigilance cycle When there is no vigilance control input detected, then the cumulative elapsed time before the onset of, and the time intervals between the visible and audible alarm indications, and brake penalty application shall be as specified in Table 1 or Table 2, depending the type of system fitted. If after the elapsed time specified in Table 1 or Table 2, from the initial vigilance acknowledgment, the driver/operator has not made another vigilance acknowledgment via the available system control inputs, the following shall occur: An in-cab visible warning shall commence in the form a flashing light located such that it is visible to all crew personnel, under all operating conditions. The driver/operator shall respond to the visible warning through the operation of any of the task linked driving controls, or the press of the vigilance acknowledgment button, or by fully depressing the driver s operator enable system foot pedal (if fitted), for no more than three (3) seconds. If the visible warning is not acknowledged within the time interval specified in Table 1 or Table 2, from the onset of the visible warning, an audible warning will sound. The audible warning shall be JHR UNCONTROLLED WHEN PRINTED Page 14 of 19

15 audible to the crew persons under all operating conditions. The driver/operator shall respond to the audible warning sound in the same manner as for the visible warning. If the audible warning is not acknowledged within the time interval specified in Table 1 or Table 2, from the onset of the audible warning, a brake penalty is initiated by venting the train/vehicle brake pipe. It shall not be possible to release the brakes until the time stated in Table 1 or Table 2 has elapsed. Once the time has elapsed, the vigilance cycle can be reset, by pressing the acknowledgment button and the brakes can be operated, in the normal manner. If an owner/operator proposes an alternate vigilance control system, this will be considered providing the system has been approved by the CRN Manager and by ONRSR (Office of National Rail Safety Regulator). 7.3 Vigilance control driver/operator interface Vigilance system acknowledgment and task linking Timing Acknowledgement of the vigilance system may be made through pressing the acknowledgement button or automatically via task linked activities which may include: a minimum meaningful movement of the power controller handle a minimum meaningful movement of the brake controller handle a set operation of the operator enable system foot peddle (where fitted) operation of the warning horn (driver/operator only) operation of the headlight high/low beam switch (where fitted) Task linked vigilance control systems are preferred over non-task linked systems and are mandatory for passenger rolling stock (and locomotives designed to operate exclusively for passenger operations) as per Section 4.1. The acknowledgement of the vigilance control system pre-emptively before the visual warning period by non-task linked inputs (vigilance acknowledgment button or OES pedal) is not permitted. That is, resetting of the vigilance control system by use of the vigilance acknowledge button should only occur during the visual or visual and audible warning periods. This is a mandatory feature for passenger rolling stock (and locomotives designed to operate exclusively for passenger operations). The system design shall be such that, if the vigilance acknowledgment button and/or operator enable foot pedal are held depressed, the time cycle will continue uninterrupted and continue through the cycle as if no acknowledgment had been made. When there is no vigilance control input detected, then the cumulative elapsed time before the onset of and the time intervals between, the visible and audible alarm indications and brake penalty application shall be as specified in Tables 1 or 2. Notes relating to Table 1: 1. The minimum time before the vigilance control system can be reset after a penalty brake application, is 30 seconds. 2. Some vigilance systems are designed to be only acknowledged after the visual warning. That is, an acknowledgment made before the visual warning, does not reset the vigilance control system timing cycle. 3. Locomotives operating exclusively in shunting yards do not require a driver safety system however, if such locomotives are required to be moved on the main line they must be hauled dead attached or operated within a locomotive consist but not as the lead locomotive. JHR UNCONTROLLED WHEN PRINTED Page 15 of 19

16 4. Locomotives operating in yards and sidings under the control of a single person, that is, where the second person is required to work at ground level carrying out the duties of a shunter, must be fitted with a driver safety system. Rolling Stock Type Multiple Unit Passenger - Suburban or Intercity Multiple Unit Passenger - Regional or Interstate Passenger (Loco Hauled) (Driver + 2nd person) Freight (Driver Only) (Note 4) Freight (Driver + 2nd Person) Infrastructure Maintenance Vehicles (Operator + 2nd Person) Maximum time interval from acknowledgment to visual warning Maximum time interval from visual to audible warning Total elapsed time from acknowledgement to audible warning Maximum time interval from audible warning to brake penalty Table 1 - Timings for a non-speed dependent vigilance control system Total elapsed time from acknowledgement to brake penalty (Seconds) (Seconds) (Seconds) (Seconds) (Seconds) Vehicle/Train Speed (km/h) Notes relating to table 2: Maximum time interval from acknowledgment to visual warning Maximum time interval from visual to audible warning Total elapsed time from acknowledgement to audible warning Maximum time interval from audible warning to brake penalty Table 1 - Timings for a speed dependent vigilance control system Total elapsed time from acknowledgement to brake penalty (Seconds) (Seconds) (Seconds) (Seconds) (Seconds) 0 to over 75 to Over 90 to Greater than Where a vehicle is fitted with a speed dependent vigilance control system, the maximum times must not exceed any of the specified timings for any speed. 6. In the event of a defective speed input signal, the vigilance timings shall default to the time periods for the Greater than 110 km/hr speed range. 7. After a train/vehicle has come to a stop following a vigilance penalty application, the vigilance system must not be able to be reset for at least a further 3 seconds. If the speed signal is faulty, the reset must not occur until at least 45 seconds from the time of the penalty application. JHR UNCONTROLLED WHEN PRINTED Page 16 of 19

17 8 Human factors 8.1 Vigilance warning light The in-cab visible warning (vigilance) light shall be clearly visible to the driver/operator at any time of the day or night and still not diminish the driver/operator's night vision. Vehicles fitted with a vigilance system shall have a control for the driver/operator to permit the brightness of the vigilance light to be adjusted, consistent with maintaining the required level of safety warning. 8.2 Vigilance acknowledgment button The vigilance acknowledgment button/s shall be located on the driver's/operator s desk or on a vertical face in the cab control area such that the driver/operator shall be able to reach the button with an outstretched arm and without upper body movement. The button shall not be located such that it can be operated by the movement of the driver/operator s thigh, knee or foot. 8.3 Vigilance audible warning device The vigilance audible warning shall be distinguishable from any other audible information devices from within the cab. 9 On board data logging The operation of the driver (train) safety system functions shall be recorded on the on-board data logger. Where a separate maintenance data logger is not installed on a vehicle then the driver (train) safety system shall include a facility for logging information relating to the operation of key vehicle/train control and safety system functions. 10 Alternate driver (train) safety systems If an owner/operator proposes alternate driver (train) safety systems, this will be considered providing the system has been approved by ONRSR (Office of National Rail Safety Regulator). JHR UNCONTROLLED WHEN PRINTED Page 17 of 19

18 Appendix 1 CRN Rolling Stock Glossary This appendix defines words that are used in the CRN Rolling Stock Standards Agreed Approved Authorised person Cant deficiency Continuous effort Curved wheel web Design speed tractive Flat top trolley or trailer Freight Train Full supplies, Fully provisioned Handbrake Heritage vehicle Infrastructure maintenance vehicle Light locomotive Locomotive Multiple unit train Net brake ratio Agreed between the Owner/Operator and the CRN Manager. Approved by the CRN Manager. Person authorised to travel in the cab of an infrastructure maintenance vehicle/train and stop the vehicle/train in the event of an emergency. The difference in superelevation between: - that required to balance the actual vehicle centrifugal force due to curve negotiation such that there is equal wheel loading on the high and low rail, (equilibrium or balancing speed), and - the actual superelevation existing in the curve. Cant deficiency is a function of superelevation, curve radius and vehicle speed. The tangential force that can be applied at the wheel/rail interface by a self powered vehicle for an indefinite period without causing wheel spin or overheating of the traction equipment. Wheel web or plate which is domed such that its cross section is curved. The maximum speed at which a vehicle is expected to operate on the CRN. A small non-powered infrastructure maintenance vehicle which is used for conveying tools and equipment along the track and which can be easily removed from the track. A train predominantly consisting of freight vehicles. Locomotive with all equipment and full of fuel, oil, water, coolant and sand. A mechanical device provided on a train/vehicle in order to secure the train or an individual vehicle so as to prevent it from moving. Note: Where the term handbrake is used, it will also mean parking brake. Locomotive, passenger vehicle, freight vehicle or trolley that has historical significance and/or is not used in regular revenue service but used in special interest operations, such as steam tours. A rail bound self propelled vehicle which is used to carry out inspection and/or maintenance on railway infrastructure. Some of these vehicles may be removed from the railway track by the use of special take-offs or portable turnouts. One or more locomotives coupled together without hauled vehicles attached. A self propelled vehicle, powered by any form of energy, which does not convey passengers or freight but which is used to move one or more other vehicles thus forming a train. A distributed power train made up of similar electric or diesel powered vehicles and non-powered vehicles operating as a unit. The ratio of the sum of the actual measured brake block forces divided by the total vehicle weight. JHR UNCONTROLLED WHEN PRINTED Page 18 of 19

19 On-track infrastructure maintenance vehicle Overhead wiring vehicle Power car Quadricycle Qualified worker Rail-bound infrastructure maintenance vehicle Road/rail vehicle Rolling Stock Exemption Certificate Rolling Stock Standards Waiver Starting tractive effort Straight wheel web S-plate wheel Substantially vehicle TOC Waiver Track vehicle Train modified maintenance Any infrastructure maintenance vehicle which operates exclusively on railway track. An infrastructure maintenance vehicle with an elevating platform or equipped for maintenance of the overhead traction wiring system. A self propelled vehicle, which may or may not convey passengers and/or freight, and operates in conjunction with similar vehicles in a multiple unit consist. A small self propelled rail-bound track vehicle which can be easily removed from the track. A worker certified as competent to carry out the relevant task. An on-track infrastructure maintenance vehicle that cannot be removed from track without the use of a heavy crane. These vehicles are transferred around the network by rail. Any type of track vehicle which can travel on either road or rail and can readily transfer from one mode of operation to the other. A Certificate issued to a vehicle owner/operator covering vehicle nonconformances which are technically acceptable. These certificates remain in place for the life of the vehicle. A Waiver issued for a vehicle covering non-conformances that are deemed acceptable for a limited time period, until corrected. The tangential force applied at the wheel/rail interface that can be applied by self powered vehicle, to move itself and its trailing load from a stationary state without causing excessive wheel slip. Wheel web consisting of a flat plate with no curvature such that its cross section is straight. Used primarily with wheel cheek mounted disc brakes Wheel with a web such that its cross section forms an S shape, designed to provide low wheel rim stresses Vehicle modified to accommodate its use for a different purpose. Vehicle undergoing major refurbishment with updated equipment which can alter the braking, traction or suspension system performance. Vehicle being moved with equipment removed resulting in a reduction of vehicle mass that could alter the vehicle performance. Vehicle modified such that it may be incompatible with the infrastructure. An authority issued for the movement of a vehicle for which there are no published operating conditions, or for which the operating conditions are different from those published in the CRN Train operating Conditions Manual. Infrastructure maintenance vehicle used for the maintenance, construction or inspection of track. One or more rail vehicles operating singularly or coupled together, hauled or self powered and capable of operating track signal circuits JHR UNCONTROLLED WHEN PRINTED Page 19 of 19